If LDAP authentication is used space can be added to username to bypass ACL restrictuions.
vulners.com/securityvulns/securityvulns:doc:7640